Where is log of user logon and log ff in WCS or WLC?

My configuration is 4404 WLCs with WCS. We have a guest WLAN configured and the users authenticate using Web Auth and local accounts created by a Lobby Ambassador. My question is if there is a log somewhere that records when users logon and logoff when they are authenticating to local accounts.

This is the start of a display filter cross reference between Wireshark and OmniPeek.
The 1st installment is a table of advanced filters. More filters will be added as time allows.
It is a living doc, so check back for changes every so often
Please feel ...
view more